amadey | a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07/06/2024, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d.exe
Size 489KB
Sample240607-ft93xaab2t
SHA256 a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d
MD5 640b35e62443a62ba15beba6aa317500
SHA1 09bac93ca0e9e16cc840d22e45a7f14f54a0745c
SHA512 0046cbe3974aa855c4746270873bb5976727f325606538f15e82c30f3a4225894840b8c2a853267780d99ecd83c5ee56120adae4d079f7683d9481a29bd6b10a
SSDEEP 6144:Oc0LIpbZrTSoNGAtGMbJ/Po13iKoBcymNzUEpKRzCnuzZs9rxzkETgY4Tavc:r0spbZrTJGMdkRoBjVZCnuzZs9rZTgN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey 9a3efc trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

9a3efc

http://check-ftp.ru

Attributes

install_dir
b9695770f1
install_file
Dctooux.exe
strings_key
1d3a0f2941c4060dba7f23a378474944
url_paths
/forum/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Executes dropped EXE 3 IoCs

pid	Process
1656	Dctooux.exe
1500	Dctooux.exe
4776	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 31 IoCs

pid	pid_target	Process	procid_target
3600	3580	WerFault.exe	77
4936	3580	WerFault.exe	77
4608	3580	WerFault.exe	77
4384	3580	WerFault.exe	77
4976	3580	WerFault.exe	77
1740	3580	WerFault.exe	77
3380	3580	WerFault.exe	77
4656	3580	WerFault.exe	77
2652	3580	WerFault.exe	77
4776	3580	WerFault.exe	77
4564	3580	WerFault.exe	77
3512	1656	WerFault.exe	98
3268	1656	WerFault.exe	98
3156	1656	WerFault.exe	98
2600	1656	WerFault.exe	98
4808	1656	WerFault.exe	98
3872	1656	WerFault.exe	98
5000	1656	WerFault.exe	98
804	1656	WerFault.exe	98
4392	1656	WerFault.exe	98
1560	1656	WerFault.exe	98
4752	1656	WerFault.exe	98
1396	1656	WerFault.exe	98
1364	1656	WerFault.exe	98
1596	1656	WerFault.exe	98
2200	1656	WerFault.exe	98
3500	1656	WerFault.exe	98
3788	1656	WerFault.exe	98
3144	1500	WerFault.exe	137
3308	4776	WerFault.exe	140
1564	1656	WerFault.exe	98

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3580	a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 1656	3580	a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d.exe	98
PID 3580 wrote to memory of 1656	3580	a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d.exe	98
PID 3580 wrote to memory of 1656	3580	a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d.exe	98

C:\Users\Admin\AppData\Local\Temp\a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d.exe
"C:\Users\Admin\AppData\Local\Temp\a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 776
  2⤵
  - Program crash
  PID:3600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 820
  2⤵
  - Program crash
  PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 840
  2⤵
  - Program crash
  PID:4608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 924
  2⤵
  - Program crash
  PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 924
  2⤵
  - Program crash
  PID:4976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 972
  2⤵
  - Program crash
  PID:1740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 956
  2⤵
  - Program crash
  PID:3380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 840
  2⤵
  - Program crash
  PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 1132
  2⤵
  - Program crash
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 584
    3⤵
    - Program crash
    PID:3512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 604
    3⤵
    - Program crash
    PID:3268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 632
    3⤵
    - Program crash
    PID:3156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 652
    3⤵
    - Program crash
    PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 756
    3⤵
    - Program crash
    PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 896
    3⤵
    - Program crash
    PID:3872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 764
    3⤵
    - Program crash
    PID:5000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 928
    3⤵
    - Program crash
    PID:804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 960
    3⤵
    - Program crash
    PID:4392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 980
    3⤵
    - Program crash
    PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1064
    3⤵
    - Program crash
    PID:4752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1072
    3⤵
    - Program crash
    PID:1396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1448
    3⤵
    - Program crash
    PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1556
    3⤵
    - Program crash
    PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1456
    3⤵
    - Program crash
    PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1616
    3⤵
    - Program crash
    PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1612
    3⤵
    - Program crash
    PID:3788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 900
    3⤵
    - Program crash
    PID:1564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 1568
  2⤵
  - Program crash
  PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 760
  2⤵
  - Program crash
  PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3580 -ip 3580
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3580 -ip 3580
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3580 -ip 3580
1⤵
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3580 -ip 3580
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3580 -ip 3580
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3580 -ip 3580
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3580 -ip 3580
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3580 -ip 3580
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3580 -ip 3580
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3580 -ip 3580
1⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3580 -ip 3580
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1656 -ip 1656
1⤵
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1656 -ip 1656
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1656 -ip 1656
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1656 -ip 1656
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1656 -ip 1656
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1656 -ip 1656
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1656 -ip 1656
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1656 -ip 1656
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1656 -ip 1656
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1656 -ip 1656
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1656 -ip 1656
1⤵
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1656 -ip 1656
1⤵
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1656 -ip 1656
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1656 -ip 1656
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1656 -ip 1656
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1656 -ip 1656
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1656 -ip 1656
1⤵
PID:1752

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 480
  2⤵
  - Program crash
  PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1500 -ip 1500
1⤵
PID:3528

C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 480
  2⤵
  - Program crash
  PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4776 -ip 4776
1⤵
PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1656 -ip 1656
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

474490143322

Path C:\Users\Admin\AppData\Local\Temp\474490143322
Size 81KB
SHA256 81d5a7d9f47b266e2c11cec10cb2f0c082c31712c2bb6e9039238220deca103c
MD5 47dd9b366daec67260c086d0e0a37f2e
SHA1 b414e46ce05015a40fe9033eda855cc373505113
SHA512 a4953b772de1e604619d5683372f66bc92f36dcfa896da87addbe9b7f9d32d751429975b09b7293cfad48f31798c45ce0e2e6966b4337fe252fb07f2f221af15
SSDEEP 1536:sRW82NxrcGoIHSfS5kMZfGxY6n43X0rYb5cr:oQ2mF6aq40Ocr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dctooux.exe

Path C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe
Size 489KB
SHA256 a6008984e97e2336a4a267cd3c5cce17a67468c783f8ea9134081a260a02007d
MD5 640b35e62443a62ba15beba6aa317500
SHA1 09bac93ca0e9e16cc840d22e45a7f14f54a0745c
SHA512 0046cbe3974aa855c4746270873bb5976727f325606538f15e82c30f3a4225894840b8c2a853267780d99ecd83c5ee56120adae4d079f7683d9481a29bd6b10a
SSDEEP 6144:Oc0LIpbZrTSoNGAtGMbJ/Po13iKoBcymNzUEpKRzCnuzZs9rxzkETgY4Tavc:r0spbZrTJGMdkRoBjVZCnuzZs9rZTgN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1500-45-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/1656-31-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/1656-22-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/1656-39-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/3580-21-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3580-20-0x0000000003530000-0x000000000359B000-memory.dmp

Download

memory/3580-19-0x0000000000400000-0x0000000001825000-memory.dmp

Download

memory/3580-3-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3580-2-0x0000000003530000-0x000000000359B000-memory.dmp

Download

memory/3580-1-0x00000000019C0000-0x0000000001AC0000-memory.dmp

Download

memory/4776-54-0x0000000000400000-0x0000000001825000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads